Previous face anti-spoofing methods are highly limited by the scale and variation of the datasets. Commonly used datasets [1]}, [2]}, [3]}, [4]}, [5]} contain less than 100 identities during training, and the spoof images are captured under limited variation. Based on our observation, training on such datasets with a binary classification model is prone to overfit to the biases introduced by the data collection, and the learned features are vulnerable in the unseen testing scenarios. Therefore, previous face anti-spoofing works [2]}, [7]}, [8]}, [9]}, [10]}, [11]} leverage auxiliary pixel-wise supervision (e.g., the facial depth map and reflection map) as a strong prior knowledge to achieve better generalization ability under testing scenarios with unseen illumination or spoof types. The other FAS works [12]}, [13]} propose to adopt Generative Adversarial Network (GAN) to disentangle the feature maps of live faces and spoof images by reconstructing new live and spoof facial images. Despite the effectiveness of these spoof-detecting techniques, it is still remained as an open question to describe the intrinsic cues learned from networks. Yu  [8]} rephrase FAS as a structural material recognition problem, which assumes that the discrimination of the structural materials between human facial skin and physical spoofing carriers is the essence for FAS tasks. Following the similar motivation, we believe that the capability of recognizing and comparing different fine-grained material types is the key to learn robust intrinsic cues for FAS.
<FIGURE>